The newest Glenn Greenwald bombshell exclusive story is out, and already people are hyperventilating on Twitter that it proves the NSA has “direct access” to Microsoft’s servers: Revealed: How Microsoft Handed the NSA Access to Encrypted Messages.

The claims made by the article (note that there are no source documents to ensure that nothing is being quoted out of context):

The documents show that:

• Microsoft helped the NSA to circumvent its encryption to address concerns that the agency would be unable to intercept web chats on the new Outlook.com portal;

• The agency already had pre-encryption stage access to email on Outlook.com, including Hotmail;

• The company worked with the FBI this year to allow the NSA easier access via Prism to its cloud storage service SkyDrive, which now has more than 250 million users worldwide;

• Microsoft also worked with the FBI’s Data Intercept Unit to “understand” potential issues with a feature in Outlook.com that allows users to create email aliases;

• Skype, which was bought by Microsoft in October 2011, worked with intelligence agencies last year to allow Prism to collect video of conversations as well as audio;

• Material collected through Prism is routinely shared with the FBI and CIA, with one NSA document describing the program as a “team sport”.

Notice — there’s nothing in here about “direct access” to anything, although there are lots of hints and suggestions and innuendo. What’s being described are negotiations between the NSA and Microsoft to develop protocols for handling information… but you have to read all the way down to the 13th paragraph before you get to the most important part of the article:

Targeting US citizens does require an individual warrant…

I’ve learned that when a new Greenwald bombshell comes out, you can cut right to the chase by searching the document for the word “warrant.” So far it hasn’t failed once to bring up that little note about the NSA needing individual warrants to access data of US citizens, or foreigners on US soil — a little note that’s always surrounded by distortion and fear-mongering and exaggeration.

Microsoft gave a statement to the Guardian about this new article:

In a statement, Microsoft said: “When we upgrade or update products we aren’t absolved from the need to comply with existing or future lawful demands.” The company reiterated its argument that it provides customer data “only in response to government demands and we only ever comply with orders for requests about specific accounts or identifiers”.

Notice how Greenwald (or one of his co-authors) casts the Microsoft statement as an “argument,” again trying to pump some air into that deflated “direct access” balloon.

There is one point raised in this article that isn’t news, but does affect the individual warrant requirement:

Blanket orders from the secret surveillance court allow these communications to be collected without an individual warrant if the NSA operative has a 51% belief that the target is not a US citizen and is not on US soil at the time.

This is a valid point, and it’s one of the issues that needs to be further addressed in some way. There’s a reason for the rule: in some cases it’s simply not possible to accurately determine the origin of Internet or cell phone data. But I think the “51%” rule violates the spirit (if not the letter) of the 4th Amendment’s protection against unreasonable search and seizure, and I’d prefer to see a protocol that would err on the side of assuming it’s a US citizen in cases where the metadata doesn’t provide a clear location.

It should be noted that for the vast majority of Internet users in the US (who use one of the major ISPs), this will never be an issue since the IP address’s US origin will always be clear.

In an article that unfortunately takes the claims in Greenwald’s piece at face value, the Atlantic has a more complete response from Microsoft:

We have clear principles which guide the response across our entire company to government demands for customer information for both law enforcement and national security issues. First, we take our commitments to our customers and to compliance with applicable law very seriously, so we provide customer data only in response to legal processes. Second, our compliance team examines all demands very closely, and we reject them if we believe they aren’t valid. Third, we only ever comply with orders about specific accounts or identifiers, and we would not respond to the kind of blanket orders discussed in the press over the past few weeks, as the volumes documented in our most recent disclosure clearly illustrate. To be clear, Microsoft does not provide any government with blanket or direct access to SkyDrive, Outlook.com, Skype or any Microsoft product. Finally when we upgrade or update products legal obligations may in some circumstances require that we maintain the ability to provide information in response to a law enforcement or national security request. There are aspects of this debate that we wish we were able to discuss more freely. That’s why we’ve argued for additional transparency that would help everyone understand and debate these important issues.